Managing security and compliance of volatile systems

Abstract

An inventory manager optimizes the security and maintenance of a plurality of virtual machines and their workloads in a cloud environment and has: an inventory database, a workload compliance history of scanning workloads database, and a workload category database including security rules and compliance policies relating to workload category in a repository. The inventory manager identifies changes to characteristics of the workload of the plurality of virtual machines; alters the inventory database stored in the repository and maintained by the inventory manager, based on the identified changes to the characteristics of the workload of the plurality of virtual machines; and initiates security rules and compliance policies of the workload category database based on the identified changes to the characteristics of the workload of the plurality of virtual machines through a security tools program.

What is claimed is: 
     
         1 . A method for optimizing the security and maintenance of a plurality of virtual machines and their workloads with an inventory manager comprising an inventory database, a workload compliance history of scanning workloads database, and a workload category database including security rules and compliance policies relating to workload category in a repository, the method comprising:
 the inventory manager identifying changes to characteristics of the workload of the plurality of virtual machines;   the inventory manager altering the inventory database stored in the repository and maintained by the inventory manager, based on the identified changes to the characteristics of the workload of the plurality of virtual machines; and   the inventory manager initiating security rules and compliance policies of the workload category database based on the identified changes to the characteristics of the workload of the plurality of virtual machines through a security tools program.   
     
     
         2 . The method of  claim 1 , wherein the identified changes to the characteristics of the workload of the plurality of virtual machines are identified as creation of a new workload in a virtualization managing environment managing the plurality of the virtual machines within a cloud computing environment. 
     
     
         3 . The method of  claim 2 , wherein the step of the inventory manager altering the inventory database stored in the repository further comprises the steps of: the inventory manager storing the new workload in the inventory database. 
     
     
         4 . The method of  claim 2 , wherein the step of the inventory manager initiating security rules and compliance policies of the workload category database based on the identified changes to the characteristics of the workload further comprises the steps of: the inventory manager searching the workload category database stored in the repository and maintained by the inventory manager for applicable security rules and compliance polices. 
     
     
         5 . The method of  claim 1 , wherein the identified changes to the characteristics of the workload of the plurality of virtual machines are identified as a suspended workload. 
     
     
         6 . The method of  claim 5 , wherein the step of the inventory manager altering the inventory database stored in the repository and maintained by the inventory manager, based on the identified changes to the characteristics of the workload of the plurality of virtual machines further comprises the steps of: the inventory manager updating the state of the workload in the inventory database and suspending maintenance of the workload within the workload compliance history of scanning workloads database. 
     
     
         7 . The method of  claim 1 , wherein the identified changes to the characteristics of the workload of the plurality of virtual machines are identified as a workload lifetime exceeding a predetermined time frame. 
     
     
         8 . The method of  claim 7 , wherein the step of the inventory manager identifying changes to characteristics of the workload of the plurality of virtual machines further comprises the step of the inventory manager determining whether the workload category has changed for the workload that has the workload lifetime that has exceeding the predetermined time frame. 
     
     
         9 . The method of  claim 8 , wherein if the workload category has changed, the step of the inventory manager altering the inventory database stored in the repository and maintained by the inventory manager, based on the identified changes to the characteristics of the workload of the plurality of virtual machines further comprises the step of the inventory manager altering the workload category in the inventory database. 
     
     
         10 . The method of  claim 8 , wherein if the workload category has changed, the step of the inventory manager initiating security rules and compliance policies of the workload category database based on the identified changes to the characteristics of the workload of the plurality of virtual machines through a security tools program further comprises the steps of: the inventory manager searching the workload category database stored in the repository and maintained by the inventory manager for applicable security rules and compliance polices. 
     
     
         11 . The method of  claim 8 , wherein if the workload category has remained the same as present in the inventory database, creating an entry for the workload in a configuration management database stored in a repository of a cloud computing environment. 
     
     
         12 . The method of  claim 1 , wherein the identified changes to the characteristics of the workload of the plurality of virtual machines are identified as a manual change to a workload category of the workload by a user. 
     
     
         13 . The method of  claim 12 , wherein the step of the inventory manager altering the inventory database stored in the repository further comprises the steps of: the inventory manager updating the workload category of a workload in the inventory database. 
     
     
         14 . The method of  claim 12 , wherein the step of the inventory manager initiating security rules and compliance policies of the workload category database based on the identified changes to the characteristics of the workload further comprises the steps of: the inventory manager searching the workload category database stored in the repository and maintained by the inventory manager for applicable security rules and compliance polices. 
     
     
         15 . The method of  claim 1 , wherein the identified changes to the characteristics of the workload of the plurality of virtual machines are identified as a deletion of a workload within the virtualization managing environment of the cloud computing environment. 
     
     
         16 . The method of  claim 15 , further comprising the step of the inventory manager demoting the workload within a configuration management database stored in a repository of a cloud computing environment. 
     
     
         17 . The method of  claim 15 , further comprising the step of removing the workload from the inventory database stored in the repository. 
     
     
         18 . The method of  claim 15 , wherein the step of the inventory manager initiating security rules and compliance policies of the workload category database based on the identified changes to the characteristics of the workload of the plurality of virtual machines through a security tools program further comprises the inventory manager sending a notification to the virtualization managing environment of the cloud computing environment to allow for deletion and cleanup of the deleted workload.